Rogue base stations (BS) can be used in wireless networks to catch identities of mobile terminals, to locate mobile terminals and to eavesdrop communication of the mobile terminals. In GSM networks (Global System for Mobile communication) performing man-in-the middle attacks is possible because the base stations of the GSM network do not authenticate themselves toward mobile terminals which they are serving. This phenomenon provides for a possibility to a rogue base station to take over one or more mobile terminals. When a mobile terminal has accepted a rogue BS as its serving base station, the rogue base station can for example command the cheated mobile terminal to deactivate its GSM encryption. When the mobile terminal makes a call, the rogue base station can reroute the call to a base station of the authentic network and convey the voice/data of the mobile terminal to the authentic mobile network. Therefore the mobile terminal does not discover that the rogue base station is cheating it.
Publication US 2006/0197702 suggests one solution to the problem of a man-in-the-middle in a case where a mobile terminal is stationary. According to the publication, in that case there does not exist a need to make handovers. However, if the rogue base station causes a handover, the mobile terminal can detect that receiving power increases and/or the direction of the transmission changes. These changes are used as a sign of a man-in-the-middle attack. However, this solution is usable only in a stationary case.
The case of a moving mobile station is more complicated. Because the mobile terminal is moving, the receiving power and/or direction of transmission of the serving base station changes. Therefore the solution suggested in US 2006/0197702 can give wrong alerts.
Rogue base stations are using features of the network reselection procedure to get the mobile terminals to camp into the rogue base station. In GSM networks mobile terminals are periodically measuring reception quality of neighbor base stations and the serving base station. When the reception quality from a neighbor base station exceeds the quality of the serving base station, the neighbor base station is selected as a serving base station according the network reselection procedure. A rogue base station masquerades a neighbor cell, and by using high transmission power and modifying network selection parameters broadcasted in system information messages the rogue base station becomes a tempting destination for cell reselection. After that, the mobile terminals in the rogue cell area will select the rogue base station as a serving cell.
A group of the cells of the cellular network can be grouped to a location area. All cells of the same location area send in the broadcast channel one and the same location area code (LAC code). Usually a rogue base station uses a LAC code different from that in the serving cell to initiate the mobile terminals to start location update procedure. If the mobile terminals try to reselect the rogue base station, it can catch identities of mobile terminals nearby.
A mobile terminal of a cellular radio system always tries to select a certain base station and camp within its coverage area. Traditionally cell reselection is based on the measurement of strength of the received radio signal, either at the base station or at the mobile terminal. For instance, in the GSM system each base station transmits a signal on the so called beacon frequency which is different for neighboring base stations. In the GSM system a base station transmits on the so-called BCCH channel (Broadcast Control Channel) the parameters p1 and p2 to the mobile terminal, whereby these parameters are used to calculate the so-called C values. For instance, the C1 value commonly used in the cellular GSM network is calculated from the equation below:C1:=(A−Max.(B,0)), where                A:=average level of the received signal—p1 (dB)        B:=p2—maximum transmission power of the terminal (dB)        p1:=allowed minimum value for the received signal        p2:=allowed maximum transmission power for a terminal.        
The terminals must measure the reception levels of the broadcast signals of all base stations which they can receive so that they will be able to calculate the C1 value of each received cell. The cell which has the highest calculated C1 value is the most advantageous regarding the radio connection. In order to optimize cell reselection the network can also transmit additional parameters which enable the use of so called C2 values. A more detailed description is presented for example in ETSI 05.08 version 6.4.0. A rogue base station tries to utilize this cell reselection phenomenon.
The base stations transmit to the mobile terminals information about the BCCH frequencies used by the neighboring cells, so that the terminals will know on which frequencies they must listen in order to find the BCCH transmissions of the neighboring cells.
FIG. 1 shows an example of an attack against a mobile terminal 150 which is possible in the prior art cellular systems. There are three authentic serving cells in the network 10: cell A 110, cell B 120 and cell C 130. They all can belong to the same location area and therefore they are sending the same LAC code in their broadcast channels. The mobile terminal 150 receives broadcast signals 111, 121 and 131 from these cells accordingly. In the depicted example of FIG. 1 the cell A 110 is the serving cell to the mobile terminal 150.
A rogue base station 101 tries to commandeer the mobile terminal 150. It uses high transmission power in its BCCH transmissions 102 compared to the transmission of the authentic cells' base stations. The rogue base station most probably uses a LAC code in its transmission which differs from the LAC codes of the authentic nearby base stations of the cellular network 10. The rogue base station can establish one or more connections 103 for example to the authentic base station of cell A 110. The base station of cell A 110 sees the rogue base station 101 as a normal mobile terminal or terminals. Therefore the authentic base station A 110 does not exclude the rogue base station 101 in its operation.
Therefore, there exists a need for a method and apparatus by which a man-in-the-middle can be detected in stationary or moving cases of a mobile terminal.